PEEP Exploits Chrome and Edge for Post-Compromise Command Execution
A Chromium-based toolkit bypasses security checks to execute host-level commands.
1Introduction to PEEP
Cybersecurity researchers have uncovered PEEP, a Chromium-based post-exploitation toolkit disguised as a bookmark extension. It requires prior administrative access to inject itself into Chrome and Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's Secure Preferences integrity values. This allows it to execute host-level commands and manage files.
2Functionality of PEEP
Once installed, PEEP polls its command-and-control server every 30 seconds over plaintext HTTP. It exfiltrates browsing history, active-tab metadata, and session cookies. Additionally, it functions as a remote access toolkit, enabling host command execution, credential theft, session hijacking, and web page alteration.
3Technical Foundations
PEEP is built on RedExt, an open-source browser data analysis and red teaming framework previously used in GlassWorm attacks. It expands on RedExt with dedicated installation routines, a native host bridge, heartbeat telemetry, and an update channel. This makes PEEP a derivative of RedExt, enhancing its capabilities.
4Installation and Persistence
PEEP masquerades as 'Smart Bookmarks' and injects itself directly into browser profiles. It maintains persistence through sideloading, enterprise force-install policies, preference-integrity manipulation, and a ScriptCache fallback. This ensures the extension remains active even after browser restarts.
5Command Execution
PEEP uses a native-messaging tool to extend its functionality beyond browser telemetry. It invokes an auxiliary executable for operating system access and runs browser-based commands locally. This transforms the malware from a credential stealer to a full remote-access tool.
6Targeting Linux Environments
The presence of a Python script, 'patch_secure_prefs_linux.py,' indicates that the threat actor is replicating PEEP's behavior to target Linux environments. This suggests a broader scope of operation beyond Windows-based systems.
7Attribution and Impact
The activity remains unattributed, but Chinese-language artifacts in the source code point to a Chinese-speaking threat actor. PEEP builds on existing host compromises, using Chrome/Edge as a persistent backdoor to bypass detection and execute commands.
8Security Implications
PEEP's ability to bypass Web Store checks and manipulate browser preferences highlights significant security vulnerabilities. Its persistence mechanisms and host-level command execution pose a serious threat to endpoint security, emphasizing the need for robust detection and mitigation strategies.